<html>
 <head>
  <meta charset="UTF-8">
 </head>
 <body>
  <h2 data-lake-id="3c4e0a25" id="3c4e0a25"><span data-lake-id="ub881097b" id="ub881097b">典型回答</span></h2>
  <p data-lake-id="uc8508941" id="uc8508941"><br></p>
  <p data-lake-id="u4549d5a3" id="u4549d5a3"><span data-lake-id="u5a323c7a" id="u5a323c7a">抓包是指通过一些常用工具截获网络通信中的数据包，主要目的是排查通信过程中产生的问题，如：<br></span><span data-lake-id="u5753d0cd" id="u5753d0cd">通过charles、chrome浏览器抓取http的数据包，分析请求和响应。<br></span><span data-lake-id="u29d514ff" id="u29d514ff">通过tcpdump、wireshark抓取tcp、udp的数据包，分析协议、分析网络请求超时问题。</span></p>
  <p data-lake-id="u0b9bee24" id="u0b9bee24"><br></p>
  <h2 data-lake-id="b3a8e5e2" id="b3a8e5e2"><span data-lake-id="ub1e51da7" id="ub1e51da7">扩展知识</span></h2>
  <p data-lake-id="u643d820f" id="u643d820f"><br></p>
  <p data-lake-id="u5ec95a9b" id="u5ec95a9b"><span data-lake-id="uf640e02b" id="uf640e02b">charles和chrome浏览器抓包都比较简单。这里只介绍tcpdump和wireshark的使用。<br></span><span data-lake-id="uf40d438c" id="uf40d438c">tcpdump是命令行形式的。wireshark有一个不错的图形界面可以用来分析tcpdump抓包生成的文件，也可以直接进行抓包。<br></span><span data-lake-id="u85546d72" id="u85546d72">一般情况下，我们的Linux服务器不会安装图形界面，所以抓包需要使用tcpdump命令生成文件，然后传到开发机上通过wireshark打开进行分析。<br></span><span data-lake-id="u38f96e87" id="u38f96e87">大多数Linux发行版都会安装tcpdump，如果没装过可以使用如下命令进行安装：</span></p>
  <p data-lake-id="ucb4e2fec" id="ucb4e2fec"><br></p>
  <pre lang="java"><code>
yum install tcpdump -y #rhel、centos上安装
apt-get install tcpdump -y # ubuntu、debian上安装
pacman -S tcpdump -y # arch、manjaro上安装
</code></pre>
  <p data-lake-id="uf826f74a" id="uf826f74a"><br></p>
  <p data-lake-id="u20cfd9c4" id="u20cfd9c4"><span data-lake-id="u0a167e61" id="u0a167e61">在使用tcpdump之前，先简单了解其工作原理：</span></p>
  <p data-lake-id="u1914da37" id="u1914da37"><span data-lake-id="udc5195ad" id="udc5195ad"><br></span><strong><span data-lake-id="u1c1fbde9" id="u1c1fbde9">Linux内核收包流程</span></strong></p>
  <p data-lake-id="u3b57c633" id="u3b57c633"><span data-lake-id="u743bdbfb" id="u743bdbfb">​</span><br></p>
  <p data-lake-id="u30cf433a" id="u30cf433a"><img src="https://cdn.nlark.com/yuque/0/2023/png/5378072/1701597242169-ac909724-1688-4e04-9d35-ee8eecb799a0.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_28%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><span data-lake-id="u56a5733d" id="u56a5733d"><br></span><img src="656691ecab64414eb6086151.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_9%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><span data-lake-id="ucbe94a51" id="ucbe94a51"><br>
    简单解释下发包流程：</span></p>
  <p data-lake-id="u4ee717c6" id="u4ee717c6"><br></p>
  <ol list="u154dd966">
   <li fid="udd63d777" data-lake-id="ub084667f" id="ub084667f"><span data-lake-id="u922529c7" id="u922529c7">网络数据包到达网卡，网卡把RingBuffer中的数据包通过DMA映射到内核的RingBuffer上，然后发出硬中断</span></li>
   <li fid="udd63d777" data-lake-id="u4b4ba1b5" id="u4b4ba1b5"><span data-lake-id="u29f343fd" id="u29f343fd">硬中断处理函数把RingBuffer数据包挂载到当前CPU核关联的poll_list双向链表中，随后发起软中断</span></li>
   <li fid="udd63d777" data-lake-id="ueacfbd8f" id="ueacfbd8f"><span data-lake-id="ub2879b1e" id="ub2879b1e">kosoftirqd内核线程处理软中断，执行网络子系统启动时注册的处理函数net_rx_action</span></li>
   <li fid="udd63d777" data-lake-id="u04c72176" id="u04c72176"><span data-lake-id="u77c7ccd0" id="u77c7ccd0">nex_rx_action函数调用网卡注册的poll函数把poll_list中的数据包摘下来，同时利用网卡GRO特性将小包合并成大包。这里就是图中的驱动部分</span></li>
   <li fid="udd63d777" data-lake-id="u3f67bf8a" id="u3f67bf8a"><span data-lake-id="u5c67c8e6" id="u5c67c8e6">驱动处理完成后要把数据包送入协议栈，在这之前还要做一些处理，图中标记的网络设备层就是干这事的，tcpdump就是在这里拦截数据包（之所以叫网络设备层，因为内核函数是以netif_receive开头的）。</span></li>
   <li fid="udd63d777" data-lake-id="uc747184f" id="uc747184f"><span data-lake-id="u483b33b4" id="u483b33b4">协议栈会对数据包拆包，即根据tcp、udp、ip等协议规则进行处理。同时这里会执行NF_HOOK函数，就是iptables过滤链。</span></li>
   <li fid="udd63d777" data-lake-id="u206b08de" id="u206b08de"><span data-lake-id="u2dc6e434" id="u2dc6e434">协议栈处理完成后，数据包放入接收队列，并唤醒用户进程</span></li>
  </ol>
  <p data-lake-id="u72e4f373" id="u72e4f373"><br></p>
  <p data-lake-id="ue00c4d27" id="ue00c4d27"><strong><span data-lake-id="u9eb25230" id="u9eb25230">这里的一个重点：tcpdump在收包场景中位于iptables之前，所以能抓到被iptables INPUT链拦截的数据包。</span></strong></p>
  <p data-lake-id="ueafea01d" id="ueafea01d"><br></p>
  <p data-lake-id="u32540cb3" id="u32540cb3"><strong><span data-lake-id="uaa0dbe60" id="uaa0dbe60">Linue内核发包流程</span></strong></p>
  <p data-lake-id="u3ae31a3e" id="u3ae31a3e"><span data-lake-id="ucbf307ae" id="ucbf307ae">​</span><br></p>
  <p data-lake-id="ub3fddc34" id="ub3fddc34"><img src="https://cdn.nlark.com/yuque/0/2023/png/5378072/1701597258013-986592f1-a0d2-45b8-a8c1-05bae4ae059e.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_28%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><span data-lake-id="u4f67135b" id="u4f67135b"><br></span><img src="656691ecab64414eb608614d.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_9%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><span data-lake-id="ubf681217" id="ubf681217"><br>
    简单解释下收包流程：</span></p>
  <p data-lake-id="u81e416d9" id="u81e416d9"><br></p>
  <ol list="u0bda7076">
   <li fid="uf7cf6bc3" data-lake-id="u985852ec" id="u985852ec"><span data-lake-id="u27f8f439" id="u27f8f439">发包是收包的逆序过程（当然内核的代码肯定是不同的，这里只是说流程是逆序的）</span></li>
   <li fid="uf7cf6bc3" data-lake-id="u59805faa" id="u59805faa"><span data-lake-id="uc683f056" id="uc683f056">收发包流程差异点在于网络设备层和协议栈之间多了个邻居子系统，其作用是发起ARP寻找目标MAC地址</span></li>
   <li fid="uf7cf6bc3" data-lake-id="udd96b4ac" id="udd96b4ac"><span data-lake-id="u231c2faa" id="u231c2faa">发包是一个主动行为，所以不需要软中断，直接调用网卡驱动，驱动向网卡发包即可</span></li>
  </ol>
  <p data-lake-id="ufe033185" id="ufe033185"><br></p>
  <p data-lake-id="u9eeb596a" id="u9eeb596a"><strong><span data-lake-id="ubb62a693" id="ubb62a693">这里的一个重点：tcpdump在发包场景中位于iptables之后，所以不能抓到iptables OUTPUT链拦截的数据包。</span></strong></p>
  <p data-lake-id="ua5a78762" id="ua5a78762"><br></p>
  <p data-lake-id="ubdd37976" id="ubdd37976"><span data-lake-id="u8cb9e314" id="u8cb9e314">数据包在内核里转换为</span><code data-lake-id="u8ef5d57f" id="u8ef5d57f"><span data-lake-id="uf30498fc" id="uf30498fc">struct sk_buff</span></code><span data-lake-id="uabaf6e6d" id="uabaf6e6d">结构体，所以tcpdump处理的就是这个结构体。</span></p>
  <p data-lake-id="u8836c949" id="u8836c949"><br></p>
  <p data-lake-id="u465d1f3e" id="u465d1f3e"><span data-lake-id="u6856f454" id="u6856f454">有了以上基础知识，再来看看tcpdump怎么使用。tcpdump有很强大的过滤规则，如：过滤给定目标ip和端口的数据包、过滤特定协议的包等。这里给出常用的使用方法：</span></p>
  <p data-lake-id="u2342c7ca" id="u2342c7ca"><br></p>
  <pre lang="java"><code>
tcpdump -i eth0 -nn -w 1.cap //-i eth0是指抓eth0网卡的包；-nn表示不解析域名和端口 这样方便查看结果；-w 1.cap是将抓到的包写到当前目录1.cap这个文件中

tcpdump -i eth0 -nn -w 1.cap tcp and host 10.182.1.1 and port 80 or port 443 //-w 1.cap后面跟着的tcp代表只抓tcp包；and和or组合多个条件；host 10.182.1.1代表只抓取这个ip的数据包（包括来自或发给这个ip的包）；port 80和port 443代表只抓取这俩个端口的包（包括来自或发给这俩个端口的包）

tcpdump -i eth0 -nn -w 1.cap tcp and dst 10.182.1.1 and dst port 80 or dst port 443 // dst 10.182.1.1代表只抓取这个ip的包，dst port代表只抓取目标端口为443的包
</code></pre>
  <p data-lake-id="udcfb1a35" id="udcfb1a35"><br></p>
  <p data-lake-id="ucc20914b" id="ucc20914b"><span data-lake-id="ua89f5a5e" id="ua89f5a5e">tcpdump过滤规则可以写的很复杂，不过如果不是产生很多的包，建议使用简单规则抓下来后传回开发机，通过wireshark进行分析。</span></p>
  <p data-lake-id="u9559815a" id="u9559815a"><br></p>
  <blockquote data-lake-id="ua7dbdb78" id="ua7dbdb78">
   <p data-lake-id="u452d31b7" id="u452d31b7"><span data-lake-id="uf4335e56" id="uf4335e56">题外话，从服务器传到开发机有很多方法，如：开发机用nc启动一个端口，服务器通过nc把包文件传输到开发机。也可以使用scp命令传输。</span></p>
  </blockquote>
  <p data-lake-id="ua565f13d" id="ua565f13d"><br></p>
  <p data-lake-id="u98568d69" id="u98568d69"><span data-lake-id="u21a4a7d6" id="u21a4a7d6">wireshark需要下载，</span><a href="https://www.wireshark.org/" target="_blank" data-lake-id="uc4307f03" id="uc4307f03"><span data-lake-id="ua50c2056" id="ua50c2056">官网地址</span></a></p>
  <p data-lake-id="u5934fb1d" id="u5934fb1d"><span data-lake-id="u9eb92a20" id="u9eb92a20"><br>
    wireshark有着直观且美观的图形界面，支持丰富的通信协议（甚至可以抓蓝牙、串口的包），强大的过滤器和数据流跟踪功能。以下介绍一些常用技巧：</span></p>
  <p data-lake-id="u8ed42367" id="u8ed42367"><br></p>
  <ol list="u819102b4">
   <li fid="ue03583f5" data-lake-id="u281f8d14" id="u281f8d14"><span data-lake-id="u46944b9c" id="u46944b9c"> 选择本机某个网卡进行抓包</span></li>
  </ol>
  <p data-lake-id="u5ec7a37e" id="u5ec7a37e"><img src="https://cdn.nlark.com/yuque/0/2023/png/5378072/1701597282609-dbfbe042-65bb-4a71-853e-ee07e9b81d75.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_31%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><span data-lake-id="uda7d84f2" id="uda7d84f2"><br></span><img src="656691ecab64414eb608614e.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_9%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><span data-lake-id="ub912160a" id="ub912160a"> </span></p>
  <ol list="u819102b4" start="2">
   <li fid="ue03583f5" data-lake-id="u992fc718" id="u992fc718"><span data-lake-id="u3b4eb40d" id="u3b4eb40d"> 点击菜单栏File-&gt;Open 可以打开tcpdump保存的文件<br></span><img src="656691ecab64414eb6086150.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_9%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><span data-lake-id="uc6e70e77" id="uc6e70e77"> </span></li>
  </ol>
  <p data-lake-id="u3b7db6e3" id="u3b7db6e3"><img src="https://cdn.nlark.com/yuque/0/2023/png/5378072/1701597297906-a956f010-4042-48e0-a72f-5e201c833da3.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_45%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"></p>
  <ol list="u819102b4" start="3">
   <li fid="ue03583f5" data-lake-id="u5f8b0463" id="u5f8b0463"><span data-lake-id="u6e06cce5" id="u6e06cce5"> 可以通过过滤器过滤数据包<br></span><img src="https://cdn.nlark.com/yuque/0/2023/png/5378072/1701597305430-a6b428be-c0b8-4985-b63d-888190c3724b.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_54%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"></li>
  </ol>
  <p data-lake-id="uc550d6b6" id="uc550d6b6"><br></p>
  <p data-lake-id="u6a940d61" id="u6a940d61"><span data-lake-id="u2ea0d2fe" id="u2ea0d2fe">wireshark的过滤器也支持算数运算符和逻辑运算符：</span></p>
  <p data-lake-id="u8727979e" id="u8727979e"><br></p>
  <ul list="u5ccd701e">
   <li fid="u450c868a" data-lake-id="u0483df2f" id="u0483df2f"><span data-lake-id="u1209b9be" id="u1209b9be">算数运算符：==、&gt;、&lt;、&lt;=、&gt;=、!=，也可以写成eq、gt、lt、ge、le、ne</span></li>
   <li fid="u450c868a" data-lake-id="u621624f9" id="u621624f9"><span data-lake-id="u72bad98a" id="u72bad98a">逻辑运算符：&amp;&amp;、||、!，也可以写成and、or、not</span></li>
  </ul>
  <p data-lake-id="ud3fbff0b" id="ud3fbff0b"><br></p>
  <p data-lake-id="u4309b8bc" id="u4309b8bc"><span data-lake-id="ue4cf0bed" id="ue4cf0bed">同时可以使用()控制规则的优先级</span></p>
  <p data-lake-id="u89b6d47d" id="u89b6d47d"><br></p>
  <p data-lake-id="udb4c7407" id="udb4c7407"><span data-lake-id="ufd61aab8" id="ufd61aab8">常用的过滤器写法：</span></p>
  <p data-lake-id="u5d4b4aea" id="u5d4b4aea"><br></p>
  <ul list="u09388cc0">
   <li fid="u07c43f84" data-lake-id="u23870962" id="u23870962"><span data-lake-id="uc81d09f3" id="uc81d09f3">tcp contains '关键词'，过滤tcp报文中包含关键词字符串的数据包</span></li>
   <li fid="u07c43f84" data-lake-id="u03030f8a" id="u03030f8a"><span data-lake-id="uecc7e1d7" id="uecc7e1d7">http，过滤http协议</span></li>
   <li fid="u07c43f84" data-lake-id="u3bf6f1b0" id="u3bf6f1b0"><span data-lake-id="ue7a66772" id="ue7a66772">ip.addr，过滤指定ip地址的数据包，如：ip.addr == 192.168.1.1</span></li>
   <li fid="u07c43f84" data-lake-id="uee3d343c" id="uee3d343c"><span data-lake-id="uba630a02" id="uba630a02">ip.src，过滤指定源ip地址的数据包，如：ip.src == 192.168.1.1</span></li>
   <li fid="u07c43f84" data-lake-id="uc70b09ea" id="uc70b09ea"><span data-lake-id="u456a0328" id="u456a0328">ip.dst，过滤目标ip地址的数据包，如：ip.dst == 192.168.1.1</span></li>
   <li fid="u07c43f84" data-lake-id="uf1f94a7e" id="uf1f94a7e"><span data-lake-id="u6d87fc00" id="u6d87fc00">tcp.port，过滤指定tcp端口的数据包，如tcp.port == 443</span></li>
   <li fid="u07c43f84" data-lake-id="u20efe136" id="u20efe136"><span data-lake-id="ua727d6c9" id="ua727d6c9">tcp.srcport，过滤指定源tcp端口的数据包，如：tcp.srcport == 443</span></li>
   <li fid="u07c43f84" data-lake-id="u40ab9a46" id="u40ab9a46"><span data-lake-id="u83606737" id="u83606737">tcp.dstport，过滤指定目标tcp端口的数据包，如：tcp.dstport == 443</span></li>
   <li fid="u07c43f84" data-lake-id="u86d136a7" id="u86d136a7"><span data-lake-id="u7062e22c" id="u7062e22c">http.request.method，过滤指定的http请求方式数据包，如：http.request.method == 'get'</span></li>
   <li fid="u07c43f84" data-lake-id="ue408466f" id="ue408466f"><span data-lake-id="u969e9905" id="u969e9905">http.request.uri，过滤指定http请求地址的数据包，如：http.request.uri matches 'baidu.com'，注意matches是使用正则表达式模糊匹配</span></li>
   <li fid="u07c43f84" data-lake-id="u5a8c6572" id="u5a8c6572"><span data-lake-id="u3554a543" id="u3554a543">http contains '关键词'，过滤http包中指定关键词的数据包，如：http contains 'User-Agent:xxx'</span></li>
  </ul>
  <p data-lake-id="u74390aa1" id="u74390aa1"><br></p>
  <p data-lake-id="uc069b589" id="uc069b589"><span data-lake-id="u9054f709" id="u9054f709">跟踪数据流，选中一个包，右键follow-&gt;tcp stream查看tcp的请求和响应，follow-&gt;http stream查看http的请求和响应<br></span><img src="65673daba7484f62fc000000.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_9%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><img src="https://cdn.nlark.com/yuque/0/2023/png/5378072/1701597368119-0606e599-e0c0-4a0e-b83e-3c600c7944ab.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_55%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"></p>
  <p data-lake-id="ua52eead1" id="ua52eead1"><br></p>
  <p data-lake-id="ua046480c" id="ua046480c"><span data-lake-id="u841d8193" id="u841d8193">修改显示的时间格式，菜单栏Edit-&gt;Preferences-&gt;Appearance-&gt;Columns，修改Title为Time的Type列。这样有助于分析请求的耗时和发生时间<br></span><img src="65673f3fa7484f62fc000001.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_9%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><span data-lake-id="ud7bb9aa6" id="ud7bb9aa6"><br></span><img src="65673f57a7484f62fc000002.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_9%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"><img src="https://cdn.nlark.com/yuque/0/2023/png/5378072/1701597332734-9087c2fe-4b9d-4b8f-a391-678126669dfa.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_20%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"></p>
  <p data-lake-id="u77f8d9ba" id="u77f8d9ba"><br></p>
  <p data-lake-id="ufe138235" id="ufe138235"><img src="https://cdn.nlark.com/yuque/0/2023/png/5378072/1701597341323-4bfa4e20-cb0c-460a-a8a3-ae67aac0e7a7.png?x-oss-process=image%2Fwatermark%2Ctype_d3F5LW1pY3JvaGVp%2Csize_28%2Ctext_SmF2YSA4IEd1IFA%3D%2Ccolor_FFFFFF%2Cshadow_50%2Ct_80%2Cg_se%2Cx_10%2Cy_10"></p>
  <p data-lake-id="u7b77a6b5" id="u7b77a6b5"><br></p>
  <p data-lake-id="udb5008ea" id="udb5008ea"><span data-lake-id="u41eb01b7" id="u41eb01b7">总结一下，掌握抓包更有利于分析问题，包括：</span></p>
  <p data-lake-id="u82699350" id="u82699350"><br></p>
  <ol list="u19301f2d">
   <li fid="u3e18079e" data-lake-id="ua54068f4" id="ua54068f4"><span data-lake-id="u3c6cd15a" id="u3c6cd15a">新接手的代码，线上出现问题，抓包分析请求参数、响应结果，对照代码分析问题</span></li>
   <li fid="u3e18079e" data-lake-id="u54b8cff2" id="u54b8cff2"><span data-lake-id="u8f5890bd" id="u8f5890bd">调用第三方接口时，分析请求参数、响应结果是否正常</span></li>
   <li fid="u3e18079e" data-lake-id="uf26b3730" id="uf26b3730"><span data-lake-id="udf3a682e" id="udf3a682e">接口性能抖动、网络问题都可以通过抓包排查</span></li>
   <li fid="u3e18079e" data-lake-id="u222bdc61" id="u222bdc61"><span data-lake-id="ub691720c" id="ub691720c">分析某个通信组件的协议，深入理解其原理</span></li>
  </ol>
  <p data-lake-id="u260c47f5" id="u260c47f5"><br></p>
  <p data-lake-id="uf919ba80" id="uf919ba80"><span data-lake-id="u2aff02f5" id="u2aff02f5">wireshark还有很多技巧，可以参考《Wireshark网络分析就这么简单》这本书。</span></p>
 </body>
</html>